Apparatus, method, and non-transitory computer-readable medium for anomaly detection

Patent metadata

Field	Value
Publication number	US-2023418701-A1
Application number	US-202318180361-A
Country	US
Kind code	A1
Filing date	Mar 8, 2023
Priority date	Jun 27, 2022
Publication date	Dec 28, 2023
Grant date	—

Abstract

An anomaly detection apparatus executes prediction processing to predict fluctuations of a normal range for a value of a parameter in a specified period, correction processing to identify an upper limit value at a local maximum point from fluctuating upper limit values of the predicted normal range, correct the upper limit values of the normal range, identify an upper limit value at a local minimum point from fluctuating upper limit values of the corrected normal range, and correct the upper limit values of the corrected normal range based on the upper limit value at the local minimum point identified, and anomaly detection processing to acquire a value of the parameter in the specified period, determine whether the value of the parameter acquired falls within the corrected normal range, and output predetermined information when determining that the value of the parameter acquired does not fall within the corrected normal range.

First claim

What is claimed is:

1 . An anomaly detection apparatus comprising a processing device configured to execute
prediction processing to predict fluctuations of a normal range for a value of a parameter in a specified period, correction processing to identify an upper limit value at a local maximum point from fluctuating upper limit values of the predicted noimal range, correct the upper limit values of the normal range based on the upper limit value at the local maximum point identified, identify an upper limit value at a local minimum point from fluctuating upper limit values of the corrected noimal range, and correct the upper limit values of the corrected normal range based on the upper limit value at the local minimum point identified, and anomaly detection processing to acquire a value of the parameter in the specified period, determine whether the value of the parameter acquired falls within the corrected normal range, and output predetermined information when determining that the value of the parameter acquired does not fall within the corrected noimal range.

2 . The anomaly detection apparatus according to claim 1 , comprising a storage device configured to store a prediction model that takes a period for the parameter as an input value and gives a normal range for a value of the parameter in the period as an output value, wherein
the processing device predicts the fluctuations of the normal range for a value of the parameter in the period by inputting information on the specified period into the prediction model.

3 . The anomaly detection apparatus according to claim 2 , wherein
the processing device updates the prediction model based on the acquired value of the parameter in the specified period.

4 . The anomaly detection apparatus according to claim 1 , wherein
the processing device determines whether there was an anomaly in a value of the parameter before the specified period, and executes the correction processing only when determining that there was an anomaly in the value of the parameter.

5 . The anomaly detection apparatus according to claim 4 , wherein
the processing device determines whether there was an anomaly in the value of the parameter before the specified period by determining whether a value of the parameter at a time before the specified period exceeds a threshold, whether the value of the parameter stays above a threshold continuously for a predetermined period or longer, or whether a difference between the value of the parameter and a threshold exceeds a predetermined value at the time.

6 . The anomaly detection apparatus according to claim 1 , wherein
in the correction processing, the processing device executes first correction processing to identify upper limit values at two local maximum points adjacent to each other in a predetermined time period from the fluctuating upper limit values of the predicted normal range, calculate values in between the identified two local maximum points by performing linear interpolation between the two local maximum points, and correct the upper limit values of the normal range in between the two local maximum points based on the calculated values.

7 . The anomaly detection apparatus according to claim 6 , wherein
after the first correction processing, the processing device executes second correction processing to identify upper limit values at two local minimum points adjacent to each other in a predetermined time period from the fluctuating upper limit values of the normal range identified based on the calculated values and the upper limit values at the identified local maximum points in the normal range, calculate values in between the identified two local minimum points by performing linear interpolation between the two local minimum points, and correct the upper limit values of the normal range in between the two local minimum points based on the calculated values.

8 . The anomaly detection apparatus according to claim 7 , wherein
in the correction processing, the processing device determines whether fluctuation of the upper limit values of the calculated noimal range was reduced, and executes the second correction processing only when deteimining that the fluctuation of the upper limit values was reduced.

9 . An anomaly detection method implemented by an information processing apparatus, comprising executing
prediction processing to predict fluctuations of a noimal range for a value of a parameter in a specified period, correction processing to identify an upper limit value at a local maximum point from fluctuating upper limit values of the predicted noimal range, correct the upper limit values of the noimal range based on the upper limit value at the local maximum point identified, identify an upper limit value at a local minimum point from fluctuating upper limit values of the corrected noimal range, and correct the upper limit values of the corrected normal range based on the upper limit value at the local minimum point identified, and anomaly detection processing to acquire a value of the parameter in the specified period, determine whether the value of the parameter acquired falls within the corrected noimal range, and output predetermined information when deteimining that the value of the parameter acquired does not fall within the corrected noimal range.

10 . A non-transitory computer-readable medium recording an anomaly detection program that causes an information processing apparatus to execute
prediction processing to predict fluctuations of a normal range for a value of a parameter in a specified period, correction processing to identify an upper limit value at a local maximum point from fluctuating upper limit values of the predicted normal range, correct the upper limit values of the normal range based on the upper limit value at the local maximum point identified, identify an upper limit value at a local minimum point from fluctuating upper limit values of the corrected normal range, and correct the upper limit values of the corrected normal range based on the upper limit value at the local minimum point identified, and anomaly detection processing to acquire a value of the parameter in the specified period, determine whether the value of the parameter acquired falls within the corrected normal range, and output predetermined information when determining that the value of the parameter acquired does not fall within the corrected normal range.

Assignees

• Hitachi Ltd

Inventors

• Wakui Taku
• Masuda Mineyoshi

Classifications

• G06F11/076 Primary

  by exceeding a count or rate limit, e.g. word- or bit count limit · CPC title

• G06F11/0793

  Remedial or corrective actions (recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40) · CPC title

• G06F11/0751 Primary

  Error or fault detection not based on redundancy (power supply failures G06F1/30; network fault management H04L41/06) · CPC title

• G06F11/0709

  in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems · CPC title

• G06F11/3006

  where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems (multiprogramming arrangements G06F9/46; allocation of resources G06F9/50) · CPC title